How it works
Who holds what between your client, their services, Operate As and your workflows, and what happens on every call.
Your client gives access to Operate As, not to you. Your workflows call Operate As with an oa_ key, and we attach the client's access to each call on our server.
Connecting, once
Your client opens their link and presses Connect
Their page lists what you asked for, in plain words. See What your client sees.
They approve on the provider's own screen
Google's screen for Google, Slack's for Slack. For services that use a key, such as Stripe, they paste a key they made there instead.
The provider hands the access to Operate As
We encrypt it and keep it with the list of permissions they approved. It never leaves our server.
Every call, step by step
Your n8n node, code, client library or MCP server says which client and which action. Then:
| Step | If it fails | |
|---|---|---|
| 1 | Your workflow calls with an oa_ key, a client and an action | |
| 2 | Key checked: it exists and hasn't been revoked | 401 |
| 3 | Scope checked: the key allows this client, service and action; the client is yours and was asked for the service; the client hasn't paused the connection or limited it to reads | 403 |
| 4 | Allowance checked: your plan has API calls left this period | 429 |
| 5 | Access renewed, if due: if the client's access has less than 5 minutes left, it's renewed first | 409 if the provider refuses, 503 if it can't be reached |
| 6 | Call sent to the service's own API, with the client's access attached | 502 |
| 7 | Result back: the service's own status and body, as { status, data } | |
| 8 | Counted: one API call against your allowance; the key and connection are marked used |
The answer you get is the service's own: its HTTP status and body, wrapped as { status, data }. See Errors for each Operate As status.
Between calls
A daily check renews every connection, used or not. Access that has ended is found by us, not by a failed workflow run. See Keeping access alive.
Why it's built this way
You never hold client tokens
A leaked workflow export or a misbehaving agent exposes an oa_ key you revoke in one click, not a client's Google account. Keys can be limited to some clients, services and actions.
No app registration for you
Operate As is registered and reviewed with Google, Microsoft, Slack, HubSpot and the rest. No credentials or verification on your side.
Your client stays in control
They approve exactly what's listed, on the provider's screen, and can remove access from their page at any time.
One place to see it all
Every call goes through Operate As, so you see each connection's status, when it was last used, and hear the moment access ends.